Cheap solid state router using Endian Firewall

I wanted to run Endian Firewall on compact flash, something which is not explicitly supported, apparently. I had 1.5GB of RAM, and Endian runs in 512 with no problem, so I figured I could use tmpfs to do /var and /tmp, helping prevent the card wearing out. I could not get Endian to install to a USB device, but a $12 CF-IDE adapter allowed me to install it on a 2GB flash card with no problem. It will disable swap automatically. You can either pop it out after you install, or you can boot off a Knoppix CD next so that you can make some modifications to your installation. If you are using the CF card via USB (I could not get Endian to install on a USB connected CF card, but I imagine I could get it to boot and run, once I installed it over IDE. After you perfect the installation, you can just dd the boot sector and each partition so that you can clone your install to new media), mount /dev/sdb3 to /mnt to access the root directory (/). Once you mount the / partition for editing, change the etc/fstab file on the CF card to read something like this:

/dev/hdb1 /boot ext3 nodev,nosuid,noatime 1 2
/dev/hdb3 / ext3 noatime 1 1
/dev/hdb4 /varperm ext3 noatime,mand 1 1
none /var tmpfs noatime,mand 0 0
none /tmp tmpfs defaults 0 0
none /home tmpfs defaults 0 0
none /proc proc defaults 0 0
none /dev/pts devpts gid=5,mode=620 0 0
/dev/cdrom /mnt/cdrom udf,iso9660 noauto,owner,kudzu,ro 0 0

Note that I moved /var to /varperm and /home to /homeperm. You can mkdir those directories under your root partition which has been mounted to /mnt.

Next, edit the etc/rc.d/rc.sysinit file. Locate the line which reads

mount -a

Add three lines immediately below it:

######copy stuff to the tmpfs filesystems
/usr/bin/rsync -a /varperm/ /var/
/usr/bin/rsync -a /homeperm/ /home/

I also added /etc/cron.d/syncflash to /etc/rc.d/rc.halt, right after the "Shutting down" line at the top of the file so that I flush to flash whenever I shut down.

This will get the necessary directories and files on boot from the flash to RAM so that scripts start correctly. That's all which is actually required! You can (and probably should) add a cron job (under /etc/cron.{minutely|hourly|daily} to periodically rsync stuff from /var to /varperm to keep historical logs. This is in /etc/cron.d/syncflash on my system:

#!/bin/sh
/usr/bin/rsync -a /var/ /varperm/
/usr/bin/rsync -a /home/ /homeperm/

I'd probably exclude the gzipped stuff, myself, but that depends on the amount of space you have. Since tmpfs allocates half your RAM by default, we effectively have a 750MB combined /tmp and /var filesystem. This is plenty, really. We can even enable the proxy and ntop, so long as we set the limits to something reasonable. I may hack it further to keep longer logs on flash and continually flush tmpfs, but what I have works for now. I think this may be a really good solution for a dedicated router box, maybe using something like a Fit PC. Addendum: Fit PC does not have enough memory for this application. But an old laptop and a PC Card CF reader might do the trick. I also had to change the options from defaults in the /var line to enable mandatory locks. Havp would not start without this setting, which kept squid from working correctly.

Worst. NIC. Ever.

I bought a couple of 10/100/1000 Ethernet cards from Fry's. Unpacking them, I discovered they had the Realtek 8169 chipset. My prior experiences with Realtek have been excellent. They make good, low cost 10/100 Ethernet cards. They work well, if unspectacularly. The 8169 is a horse of a different color, however. I run Linux pretty much everywhere except on my laptops, which are either for work or shared with my wife. Generally, I don't have hardware compatibility issues with Linux, and I don't think there is a compatibility issue here. I think the 8169 just stinks on ice. The actual throughput for this dog is far less than a gigabit speed rating would have you believe. I never saw more than about 75Mb/s. "Well, I thought, I didn't pay any premium, so I still have a perfectly useful 100Mb Ethernet adapter, right?" Wrong. When I put the NIC on a busy system, like a firewall, it crawls. It slows down to less than 1Mb/s of useable throughput. This happens for both cards, so I can't blame a buggy unit. I advise people to stay away from this card. It would be better to stick with the 8139 10/100 card, which works wonderfully. Broadcom makes good gigabit nics, but Realtek really needs to go back to the drawing board.

Brief trashing of Dune: The Battle of Corrin

Dune: The Battle of Corrin is the third book of the Butlerian Jihad trilogy by Brian Herbert and Kevin J. Anderson. The book attempts to build upon the proud legacy of Frank Herbert's classic Dune series. Unfortunately, it suffers from some terrible, fatal flaws. The characters are totally unconvincing. They simply do not recognizably react like humans. On the one hand, military people have little compunction about exterminating entire planets, but then are afraid to attack the Omnius when the thinking machines threaten to kill hostages. It is a bizarre thing to make a major plot point. I do not know if this is a weakness inherent in the notes left behind by the original creator, or an oversight by the new writers, but it completely ruins the ending of the story.

As are all Dune stories, this story is a dystopian nightmare, but the Herbert/Anderson collaborations are even worse. Earlier in the story, things were already looking bad: Rather than simply go their separate ways and divide a tribe, two people decide to have a battle to determine who gets the right to rule. And these are people who are allegedly disgusted by slavery. But there they are, deciding who will have the right to enslave, when there was a very simple solution in front of them.

I find it bizarre that no one seemed to think that it might be worth trying, as a military strategy, to attack Omnius with the Holtzmann satellite generators. They had a blanket perimeter on the planet, through which no thinking machine could pass. Why not just advance the blanket toward the planet and eradicate thinking machines as you go? You can keep building more satellites to back up those with which you are attacking. It's just a stupid oversight. Also, they exterminated planets with nuclear weapons to destroy the Omnius Everminds on those worlds, but occasionally humans survived, but Omnius did not? Why wouldn't Omnius, a machine, embed himself very deep under the crust of the planets?

At the end, Omnius plans to beam himself as a big data packet into space? Hoping for a receiver? What possible reason would there be to think that such a transmission would bring about any useable thing on the other end.

These are only a few highlights of my problems with this book. I found it to be, quite frankly, one of the worst science fiction books I have ever bothered to finish.

OpenSSH over high speed networks

We run gigabit Ethernet in the network at work. I noticed that my actual throughput on scp transfers was in the 200Mbit/s range. Iperf wirespeed tests indicated over 900Mbit/s. Now, obviously encryption will bring about some cost, but that seemed a bit much for me, so I set to try tuning things a bit. As a result, I think I can confidently make the following recommendations to those running OpenSSH over high speed networks:

1) Upgrade your SSH server. OpenSSH 4.3 was about 1/3 faster than various 3.6 or 3.9.
2) Turn off compression. This just slows you down over a high speed network. This should be done on the server side.
3) Use blowfish. In the /etc/ssh/ssh_config (client configuration file), set:
Ciphers blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
Blowfish was a bit faster than AES on the systems I tested.

The net effect was a boost to ~350Mbit/s, which is a significant improvement.

Get a UPS!

I love cheap uninterruptible power supplies (UPS). For the home user, they make a lot of sense. Replacing the batteries in a UPS often costs more than getting a new one on sale, so I just get a cheap one for each of my computers every year. I look for the $20-$40 deals they have at Fry's on a regular basis. My home has fairly dependable power. The outages I normally encounter are short, usually a second or two. That flash of power can be murder on my hard drives over the course of the year, however. For that reason, I go for the cheap, low capacity UPS devices. They work fine for these short bursts. If I needed the sorts of things which could keep me up and running for several minutes, and automatically shut down my machines, I'd go for something more costly, but a $20 UPS per year can save you a $100 hard drive, so I find it an investment well worth making.

Who This?

One of the most annoying things on earth for me is a result of one of the many marvelous technological innovations the market has brought us. All too often, my home phone will ring. I answer it, "Hello?"

"Uh, who this?"

Who this?! What sort of numbskull would actually call someone else and demand their identity? As we have house guests, this problem is becoming more pronounced. My normal reply is "You called my house. Who are you?" Often, even this does not cause the other party to come to their senses. "I saw this number in my caller ID." What you get in your caller ID is not my problem. That's why it's your caller ID and not mine. At this point, I hang up. I have no time for rude jerks who don't know how to introduce themselves on the phone. Are these people so deathly afraid that they may be calling someone with whom they do not wish to speak? If mafia hitmen, government agents or bill collectors are hounding your every step, here's a free hint: Don't call phone numbers you don't know.

One would think that such rudeness would be the custom of the young, perhaps my own age and younger. But no, these people are often old enough to be my mother or father, yet, apparently they have either never been taught manners, or have grown so old and senile as to have forgotten them. This habit appears to have no age boundary. It seems to me that this is a good time to start educating people by encouraging corrective behavior. When someone calls you and asks for your identity, kindly inform them that you are the homeowner and would like for them to identify themselves. If they give you the caller ID excuse, remind them that the lack of message requesting a callback is a good indicator that none is demanded. Finally, if they still persist, reward their persistence with a click and a dial tone.

I have had plenty of strange numbers show up in my caller ID. When I actually decide to call one, I always say, "Hi, this is Robert Wicks. Did someone from this number call me?" Note the conspicuous absence of "Hoodis?," which is how it is normally pronounced, like some word in a foreign language describing some quaint local custom. I introduce myself and treat them with the respect that others deserve. Is a bit of consideration too much to ask?

beryl invisible borders

I use Gentoo Linux at home. It's a pretty neat experience, and much easier than a compiled distribution might initially seem. I'm constantly updating to experimental packages on it, and one of my favorites is Beryl, a beautiful window manager. Recently, I noticed that beryl's window edges were invisible. I could still grab the invisible window title and drag it around, but not having visible borders was frustrating. I tried changing nvidia drivers, and updating beryl components, but I finally found that I needed to come off the bleeding edge. The beryl components were versioned 9999. Once I scaled back to th 0.2.1 (the current release), things returned to normal